Last updated: July 7, 2026
This Privacy Policy explains how Property Intelligence Technologies, Inc., doing business as Merble ("Merble," "we," "us," or "our"), collects, uses, stores, shares, protects, and deletes information in connection with our website, dashboard, and related products and services (collectively, the "Services"). By using the Services, you agree to the collection and use of information in accordance with this Policy.
Merble is a business-to-business customer-intelligence and activation platform. Our customers are businesses — such as lenders and credit unions ("Clients") — who use Merble to identify customer-intent signals and to run their own outreach to their own customers.
Because of this, we handle personal information in two distinct roles:
• As a business (controller) for information about the individual business users who visit our website and use the Merble dashboard — for example, our Clients' employees. This Policy governs how we handle that information.
• As a service provider (processor) for the customer data a Client provides so we can perform the Services ("Customer Data"). We process Customer Data only on the Client's documented instructions and for that Client's benefit. The Client, not Merble, is the controller of that data; the Client's own privacy notices and our agreement with the Client govern it. We do not sell it, use it to market to anyone, or use it to train AI models.
To be clear about what we are not: Merble does not operate a consumer lead-generation service, does not match consumers with lenders or contractors, does not perform credit checks, and does not sell personal information to anyone.
Information business users provide to us. When you create an account, use the dashboard, or contact us, we collect information such as your name, business email address, company, job title, account credentials, billing and contact details, and the contents of your communications with support.
Google account information (if you connect Gmail). Described in detail in "How We Access and Use Google User Data" below.
Information collected automatically. When you use the Services we collect device and usage data, log data, cookies, and IP addresses.
Customer Data (processed on behalf of Clients). A Client may transfer personal information about its own customers to us so that we can perform the Services. This may include non-public personal information ("NPI"). We receive it through secure API integration or encrypted file transfer and process it solely to generate intent signals, prioritized lists, and campaign guidance for that Client.
We use information to:
• provide, maintain, secure, and improve the Services;
• authenticate business users and administer accounts;
• generate customer-intent signals, prioritized lists, and campaign recommendations for the relevant Client;
• send outreach messages that a user composes or approves from within the dashboard (see the Google section below);
• perform analytics on our own operational and usage data;
• communicate with you about the Services; and
• comply with legal and regulatory obligations.
We use Customer Data only to provide the Services to the Client that provided it, in accordance with that Client's instructions and our agreement with it. We do not use Customer Data, or insights derived from it, to market to the Client's customers or anyone else, and we do not sell it.
Merble connects to your Google Account so you can send outreach to your business contacts from your own email address inside the Merble dashboard. This section discloses exactly how we access, use, store, share, and delete Google user data, in compliance with the Google API Services User Data Policy.
Google data we access. When you choose "Connect Google," we request the following OAuth scopes:
• openid, email, profile, userinfo.email, userinfo.profile — to identify you and connect your Google Account. We access your Google email address, Google account ID, name, and profile picture.
• gmail.send — permission to send email on your behalf. This scope is send-only: Merble can send messages you compose or approve, and cannot read, search, download, or access your Gmail inbox, existing messages, drafts, labels, or contacts.
How we use this data. Your identity data (email, account ID, name, picture) is used solely to authenticate you, link your Google Account to your Merble workspace, and display which account is connected. The gmail.send permission is used only to deliver outreach emails and email campaigns that you create and send from within the Merble dashboard, sent from your connected Google address. We never send email without an action you initiate. We do not use Google user data for advertising.
AI/ML disclosure. We do not use Google Workspace API data (including data obtained through the gmail.send scope) to develop, improve, or train generalized or non-personalized artificial intelligence or machine-learning models.
How we share this data. We do not sell Google user data and do not share it for advertising. We share it only with the service providers that operate our platform — our database provider (Supabase), our authentication provider (Clerk), and our cloud hosting provider (Vercel) — strictly to provide the service and under confidentiality and security obligations. Email you send is transmitted through Google's Gmail API to your chosen recipients. We may disclose data where required by law or to prevent fraud, security threats, or abuse.
How we store and protect this data. Google account details and OAuth tokens are stored in our secured cloud database. Refresh tokens are encrypted at rest using AES-256-GCM, and all data is transmitted over TLS. Access is restricted by authentication and least-privilege controls.
Data retention and deletion. We retain your Google account connection and tokens only while your Google Account remains connected to Merble. You can disconnect at any time in Settings — doing so revokes Merble's access with Google and deletes the stored tokens and connection record. You may also request deletion of your account and associated Google user data by emailing [email protected]; we will complete verified deletion requests within 30 days, except where retention is required by law.
Limited Use. Merble's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
We use artificial intelligence and machine-learning techniques to generate intent signals and campaign recommendations as part of the Services. We do not use Customer Data, Google user data, or other personal information you provide to develop, train, or improve generalized or non-personalized AI/ML models. Any AI processing of Customer Data is performed solely to deliver the Services to the applicable Client and in accordance with our agreement with that Client.
We share information only as follows:
• Service providers / subprocessors that operate our platform under confidentiality and security obligations — currently our database provider (Supabase), authentication provider (Clerk), and cloud hosting provider (Vercel), along with any additional providers we engage to deliver the Services under equivalent obligations.
• Email delivery. Outreach you send is transmitted through Google's Gmail API to the recipients you choose.
• Legal and safety. Where required by law, or to protect against fraud, security threats, or abuse.
• Business transfers. In connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
We do not sell personal information, and we do not share it for advertising.
• Encryption of sensitive data in transit (TLS) and at rest; OAuth refresh tokens encrypted at rest using AES-256-GCM.
• Multi-factor authentication, role-based access, and least-privilege controls.
• Secure, reputable cloud infrastructure, with vulnerability scanning, monitoring, and a documented incident-response plan.
• We are actively pursuing SOC 2 Type II and maintain administrative, technical, and physical safeguards designed to protect against unauthorized access, disclosure, alteration, or destruction of information.
No method of transmission or storage is completely secure. If you believe your account has been compromised, contact us immediately. We will notify affected parties of security incidents as required by applicable law and our contractual commitments.
• Business-user account data is retained while your account is active and as needed for legitimate business or legal purposes, after which it is deleted or de-identified.
• Google connection and tokens are retained only while your Google Account is connected. Disconnecting in Settings revokes our access with Google and deletes the stored tokens and connection record.
• Customer Data is retained only as long as needed to provide the Services to the applicable Client, and is returned or securely destroyed at the end of the Client engagement in accordance with our agreement with that Client.
You may request deletion of your account and associated data by emailing [email protected]. We complete verified deletion requests within 30 days, except where retention is required by law.
Where we process financial or consumer information on behalf of a Client, we act as that Client's service provider and comply with applicable laws, which may include the Gramm-Leach-Bliley Act (GLBA), the Right to Financial Privacy Act (RFPA), the NCUA Privacy of Consumer Financial Information rule (12 C.F.R. Part 716), and the Fair Credit Reporting Act (FCRA) where applicable. We process such information only to provide the Services and do not use it for our own purposes.
We and our service providers use cookies and similar technologies to keep you signed in, remember your preferences, secure the Services, and analyze usage. We do not use cookies for advertising. You can manage cookie preferences through your browser or device settings.
Depending on your location, you may have rights to access, correct, delete, or export your personal information, and to opt out of certain processing. To exercise these rights, contact [email protected]. If your request concerns Customer Data we process on behalf of a Client, we will refer the request to that Client, who is responsible for the data as its controller.
If you are a California resident, you may have rights under the California Consumer Privacy Act, as amended (CCPA/CPRA), including the rights to know, delete, and correct personal information, and to opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined under the CCPA. Note that certain financial information subject to the GLBA or FCRA may be exempt from the CCPA.
Our Services are not directed to children under 13, and we do not knowingly collect personal information from children under 13.
From time to time we may offer additional features as optional, opt-in services (for example, additional outreach channels or data-enrichment capabilities). If we introduce such a feature and it involves new categories of data or new service providers, we will update this Policy to describe it, and we will enable the feature for you only if you choose to turn it on.
We may update this Privacy Policy from time to time. We will post the updated Policy on the Services with a revised "Last updated" date.
Property Intelligence Technologies, Inc. (d/b/a Merble)
Privacy questions: [email protected]
Deletion requests: [email protected]